How to List All Connected SSH Sessions on Linux

Secure Shell (SSH) is a commonly used protocol for secure remote access to Linux servers. When multiple users are connected to a Linux server via SSH, it can be useful to list all connected SSH sessions for administrative or monitoring purposes. In this article, we will discuss how to list all connected SSH sessions on Linux using various command-line tools.

Using the who Command

The who command is a simple and widely available command-line tool for listing logged-in users on a Linux system. To list all connected SSH sessions, you can use the who -a command. The -a option shows all users, including those who are not logged in through the system console.

who -a

root     pts/0        2020-12-19 14:20 (10.0.0.1)
user1    pts/1        2020-12-19 15:25 (10.0.0.2)
user2    pts/2        2020-12-19 14:30 (10.0.0.3)

The output shows three users currently connected: root, user1, and user2, along with their terminal (pts), login time, and source IP addresses in parentheses.

Using the w Command

The w command displays information about users currently logged on to the system and shows the processes each user is running. To list SSH sessions without the header, use the -h option:

w -h

root     pts/0    10.0.0.1    14:20    2.00s  0.04s  0.00s  bash
user1    pts/1    10.0.0.2    14:25    1.00s  0.02s  0.00s  vim
user2    pts/2    10.0.0.3    14:30    1.00s  0.01s  0.00s  top

This command provides additional details including idle time, CPU usage (JCPU and PCPU), and the current process being executed by each user.

Using the last Command

The last command displays users who have recently logged on to the system. Use the -i option to show IP addresses:

last -i

root     pts/0        10.0.0.1       Sun Dec 19 14:20   still logged in
user1    pts/1        10.0.0.2       Sun Dec 19 14:25   still logged in
user2    pts/2        10.0.0.3       Sun Dec 19 14:30   still logged in
admin    pts/3        10.0.0.4       Sun Dec 19 13:15 - 13:45  (00:30)

This output shows both current and recent sessions, including session duration. Active sessions display "still logged in" while completed sessions show the logout time and duration.

Using who with Additional Options

You can use who -u to display user information with idle time:

who -u

root     pts/0        2020-12-19 14:20   .          9987 (10.0.0.1)
user1    pts/1        2020-12-19 14:25  00:02       9991 (10.0.0.2)
user2    pts/2        2020-12-19 14:30  00:01       9995 (10.0.0.3)

The -u option shows idle time (dot means currently active) and process IDs. This helps identify which sessions are actively being used.

Using the ss Command

The ss command (socket statistics) is more efficient than netstat and can show active SSH connections at the network level:

ss -t -a | grep :ssh

ESTAB  0  0  192.168.1.100:ssh  10.0.0.1:46754  users:(("sshd",pid=9987,fd=3))
ESTAB  0  0  192.168.1.100:ssh  10.0.0.2:47754  users:(("sshd",pid=9991,fd=3))
ESTAB  0  0  192.168.1.100:ssh  10.0.0.3:48754  users:(("sshd",pid=9995,fd=3))

The -t option shows TCP connections, -a shows all sockets, and grep :ssh filters for SSH connections. This method shows the actual network connections and associated sshd process IDs.

Comparison of Methods

Conclusion

Multiple command-line tools are available for monitoring SSH sessions on Linux systems. The who and w commands provide user-focused information, while last offers historical data and ss gives network-level details. Choose the tool that best matches your monitoring needs and always consult the man pages for complete option details.